SUSE-CU-2021:276-1: Security update of suse/sles12sp3

Sat Aug 7 06:32:10 UTC 2021

SUSE Container Update Advisory: suse/sles12sp3
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2021:276-1
Container Tags        : suse/sles12sp3:2.0.2 , suse/sles12sp3:24.284 , suse/sles12sp3:latest
Container Release     : 24.284
Severity              : important
Type                  : security
References            : 1161510 1172505 1178561 1181443 1184761 1184967 1185046 1185331
                        1185562 1185807 1186015 1186229 1187105 1187212 1188063 1188217
                        1188218 1188219 1188220 CVE-2019-20387 CVE-2020-12049 CVE-2020-35512
                        CVE-2021-22922 CVE-2021-22923 CVE-2021-22924 CVE-2021-22925 CVE-2021-3200
                        CVE-2021-33560 CVE-2021-33910 CVE-2021-3541 
-----------------------------------------------------------------

The container suse/sles12sp3 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2016-1
Released:    Fri Jun 18 09:39:25 2021
Summary:     Security update for libxml2
Type:        security
Severity:    moderate
References:  1186015,CVE-2021-3541
This update for libxml2 fixes the following issues:

- CVE-2021-3541: Fixed exponential entity expansion attack that could bypass all existing protection mechanisms (bsc#1186015).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2086-1
Released:    Fri Jun 18 17:28:57 2021
Summary:     Recommended update for pam
Type:        recommended
Severity:    important
References:  1181443,1185562
This update for pam fixes the following issues:

- Fixed a bug, where the 'unlimited'/'-1' value was not interpreted correctly (bsc#1181443)
- In the 32-bit compatibility package for 64-bit architectures, require 'systemd-32bit' to be also installed as it contains pam_systemd.so for 32 bit applications. (bsc#1185562)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2156-1
Released:    Thu Jun 24 15:39:39 2021
Summary:     Security update for libgcrypt
Type:        security
Severity:    important
References:  1187212,CVE-2021-33560
This update for libgcrypt fixes the following issues:

- CVE-2021-33560: Fixed a side-channel against ElGamal encryption, caused by missing exponent blinding (bsc#1187212).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2180-1
Released:    Mon Jun 28 17:40:39 2021
Summary:     Security update for libsolv
Type:        security
Severity:    important
References:  1161510,1186229,CVE-2019-20387,CVE-2021-3200
This update for libsolv fixes the following issues:

Security issues fixed:

- CVE-2019-20387: Fixed heap-buffer-overflow in repodata_schema2id (bsc#1161510)
- CVE-2021-3200: testcase_read: error out if repos are added or the system is changed too late (bsc#1186229)

Other issues fixed:

- backport support for blacklisted packages to support ptf packages and retracted patches
- fix ruleinfo of complex dependencies returning the wrong origin
- fix SOLVER_FLAG_FOCUS_BEST updateing packages without reason
- fix add_complex_recommends() selecting conflicted packages in rare cases
- fix potential segfault in resolve_jobrules
- fix solv_zchunk decoding error if large chunks are used

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2419-1
Released:    Wed Jul 21 10:06:22 2021
Summary:     Security update for curl
Type:        security
Severity:    moderate
References:  1188217,1188218,1188219,1188220,CVE-2021-22922,CVE-2021-22923,CVE-2021-22924,CVE-2021-22925
This update for curl fixes the following issues:

- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)
- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)
- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)
- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2423-1
Released:    Wed Jul 21 11:03:43 2021
Summary:     Security update for systemd
Type:        security
Severity:    important
References:  1178561,1184761,1184967,1185046,1185331,1185807,1188063,CVE-2021-33910
This update for systemd fixes the following issues:

Security issues fixed:

- CVE-2021-33910: Fixed a denial of service (stack exhaustion) in systemd (PID 1) (bsc#1188063)

Other fixes:

- mount-util: shorten the loop a bit (#7545)
- mount-util: do not use the official MAX_HANDLE_SZ (#7523)
- mount-util: tape over name_to_handle_at() flakiness (#7517) (bsc#1184761)
- mount-util: fix bad indenting
- mount-util: EOVERFLOW might have other causes than buffer size issues
- mount-util: fix error propagation in fd_fdinfo_mnt_id()
- mount-util: drop exponential buffer growing in name_to_handle_at_loop()
- udev: port udev_has_devtmpfs() to use path_get_mnt_id()
- mount-util: add new path_get_mnt_id() call that queries the mnt ID of a path
- mount-util: add name_to_handle_at_loop() wrapper around name_to_handle_at()
- mount-util: accept that name_to_handle_at() might fail with EPERM (#5499)
- basic: fallback to the fstat if we don't have access to the /proc/self/fdinfo
- sysusers: use the usual comment style
- test/TEST-21-SYSUSERS: add tests for new functionality
- sysusers: allow admin/runtime overrides to command-line config
- basic/strv: add function to insert items at position
- sysusers: allow the shell to be specified
- sysusers: move various user credential validity checks to src/basic/
- man: reformat table in sysusers.d(5)
- sysusers: take configuration as positional arguments
- sysusers: emit a bit more info at debug level when locking fails
- sysusers: allow force reusing existing user/group IDs (#8037)
- sysusers: ensure GID in uid:gid syntax exists
- sysusers: make ADD_GROUP always create a group
- test: add TEST-21-SYSUSERS test
- sysuser: use OrderedHashmap
- sysusers: allow uid:gid in sysusers.conf files
- sysusers: fix memleak (#4430)
- These commits implement the option '--replace' for systemd-sysusers
  so %sysusers_create_package can be introduced in SLE and packages
  can rely on this rpm macro without wondering whether the macro is
  available on the different target the package is submitted to.
- Expect 644 permissions for /usr/lib/udev/compat-symlink-generation (bsc#1185807)
- systemctl: add --value option
- execute: make sure to call into PAM after initializing resource limits (bsc#1184967)
- rlimit-util: introduce setrlimit_closest_all()
- system-conf: drop reference to ShutdownWatchdogUsec=
- core: rename ShutdownWatchdogSec to RebootWatchdogSec (bsc#1185331)
- Return -EAGAIN instead of -EALREADY from unit_reload (bsc#1185046)
- rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
- write_net_rules: set execute bits (bsc#1178561)
- udev: rework network device renaming
- Revert 'Revert 'udev: network device renaming - immediately give up if the target name isn't available''

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2590-1
Released:    Mon Aug  2 12:52:54 2021
Summary:     Security update for dbus-1
Type:        security
Severity:    important
References:  1172505,1187105,CVE-2020-12049,CVE-2020-35512
This update for dbus-1 fixes the following issues:

- CVE-2020-35512: Fixed a bug where users with the same numeric UID could lead to use-after-free and undefined behaviour. (bsc#1187105)
- CVE-2020-12049: Fixed a bug where a truncated messages lead to resource exhaustion. (bsc#1172505)